DISCORD DISCLOSES DATA BREACH AFTER HACKERS STEAL SUPPORT TICKETS

Summary from the TLDR InfoSec newsletter

Discord suffered a data breach on September 20. The Scattered Lapsus$ Hunters threat group compromised a third-party Zendesk customer service system, stealing personal data, including names, government IDs, partial payment information, and support communications from users who contacted Discord's support teams. The attackers demanded a ransom payment and threatened to leak the stolen data, which security experts warn could be valuable for solving cryptocurrency-related crimes, as many scammers use Discord without proper anonymization. Organizations should review their third-party vendor access controls, implement additional monitoring for customer service platforms, and ensure incident response procedures include immediate isolation of compromised third-party systems.